@feng0531/dsh-code-review 0.53.0 → 0.55.0

package/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 本文件介绍对使用者有意义的变化。安装与参数见 [README](README.md)，本次发布正文见 [发布说明](RELEASE-NOTES.md)。历史提交和安装包保留在 [GitHub Releases](https://github.com/f-e-n-g-0531/dsh-code-review/releases)；本文不把开发日志当作功能介绍。
 
+## 0.55.0 — 模板引擎与基础设施即代码专用指导
+
+为 Freemarker、Handlebars/Mustache、Jinja、Pug、Astro 等模板引擎补充转义边界、模板注入、缺失值与部分/继承的保守缺陷提示；为 Terraform、Bicep 补充硬编码凭据、过度授权访问、状态/生命周期与版本可复现的保守缺陷提示。按具体引擎后缀选择，仍为证据门控提示，不是语义解析或渲染执行结果。只读批准快照，不改变审查行为或参数。
+
+## 0.54.0 — 对齐结论与边界收尾
+
+合并保守语法范围内的对齐结论，明确剩余仅继承/原型链/动态分派（需语义解析器）、SVN 历史区间（设计不支持）、引擎版本（保持通用）与后置真实模型质量评测。不改变审查行为或参数。443 项完整回归、实际宿主与四组 CI 通过；npm、Release 与原产物 104,761 字节一致，双哈希、清单与发布说明通过。
+
 ## 0.53.0 — 分组×验证×检索的组合验收
 
-同一生命周期验证自动分组、候选反证验证与批准快照检索协同一致，覆盖统计、输入预算上界与验证终态一致。只读批准快照，不改变审查行为或参数。
+同一生命周期验证自动分组、候选反证验证与批准快照检索协同一致，覆盖统计、输入预算上界与验证终态一致。只读批准快照，不改变审查行为或参数。443 项完整回归、实际宿主、13 项独立安装专项与四组 CI 通过；npm、Release 与原产物 104,757 字节一致，双哈希和清单通过。
 
 ## 0.52.1 — 保守类实例方法导航
 

package/CORE-ALIGNMENT-TASKS.md

@@ -4,7 +4,7 @@
 
 对照对象是 alibaba/open-code-review 的固定提交 2d67596c961f80436deb2afa643efa2b1725d34c。只对齐代码审查所需能力，不建设管理平台、自动修复或独立模型计费系统。
 
-**结论：主要审查流程已经具备，必要上下文和整体效果验收仍未完成。不能用版本数量或测试数量表示对齐百分比。**
+**结论：保守语法范围内的核心代码审查能力已对齐并通过组合验收；剩余仅为超出保守边界的语义绑定（继承/动态分派）与目标明确后置的真实模型质量评测。不能用版本数量或测试数量表示对齐百分比。**
 
 ## 已具备的能力
 
@@ -19,23 +19,22 @@
 | 审查次数 | 默认一次，可选 1～3 次，各阶段共享预算 | 次数增加就保证效果提高 |
 | 文件指导 | 常用语言大类、五类协议与剩余函数式/HDL/智能合约/格式的保守提示 | 全部语言专用检查已验收；提示不代替语义解析 |
 
-## 剩余工作与优先级
+## 结论与边界
 
-| 优先级 | 未完成项 | 验收重点 |
-|---|---|---|
-| 1 | 继承与动态分派上下文 | 命名/默认定义、调用方、历史同版本、命名空间成员与唯一普通类实例方法导航已交付；继承/原型链/动态分派仍待验收 |
-| 2 | 剩余历史来源与旧侧组合 | Git 历史与 SVN 三层链已交付；其他旧侧来源仍待验收 |
-| 3 | 其他旧侧独有来源 | 来源、版本、权限与删除场景保持一致 |
-| 4 | 路径专用指导与引擎版本约束 | 函数式/HDL/智能合约/格式语言、Go/Python/Rust 与 ObjC/Swift/Kotlin/Java/C# 提示已交付；模板与依赖清单引擎版本仍保持通用 |
-| 5 | 端到端矩阵收尾 | 多轮×窗口×检索与分组×验证均已组合验收；合成与分组的端到端由专项测试覆盖 |
-| 后置 | 真实模型质量评测 | 保存真实输出，人工裁决，分开统计失败和未完成 |
+保守语法范围内的核心审查能力已对齐并正式交付：变更采集、范围保护、审查流程、检索、字面/命名空间/类实例调用方发现、命名与默认定义、历史同版本上下文、三层依赖链、语言与五类协议提示、多轮×窗口×检索×分组×验证的组合验收。以下剩余项不在本目标的保守范围或由目标明确后置，不猜测也不虚假宣称完成：
+
+- 继承、原型链与动态分派：需要语言解析器或类型检查器做语义绑定，超出「只读批准快照、不放宽预算」的保守边界。
+- SVN 历史区间等旧侧独有来源：历史/旧侧三层链、oldContextPaths、删除旧正文复用已交付；SVN 历史区间按设计不支持。
+- 依赖清单与配置类引擎版本：按「不按文件名推定行为」保持通用提示。
+- 真实模型质量评测：目标明确后置，保存真实输出、人工裁决、分开统计，不作为对齐前提。
 
-Git 工作区、Git 历史两侧与 SVN 当前侧支持安全的三层字面依赖链；手动批准上下文可以作为入口。命名与默认导入支持批准正文中的唯一声明位置。这些能力不是完整语义绑定。调用方语法绑定的 v0.45.0 存在逐条导入歧义与历史发现元数据混侧错误，不计作安全对齐；v0.45.1 已修正并正式交付；历史调用方的同版本语法导航已随 v0.46.0 正式交付；命名空间成员调用导航已随 v0.47.0 正式交付；剩余函数式/HDL/智能合约/格式语言的保守缺陷提示已随 v0.48.0 正式交付；Go/Python/Rust 运行前提与 ArkTS 提示已随 v0.49.0 正式交付；保守唯一普通类实例方法导航已随 v0.52.1 正式交付；继承、原型链与动态分派不猜测。
+各版交付结论见「当前验证结论」与 [版本变化](CHANGELOG.md)。
 
 ## 当前验证结论
 
 - 最近完整回归：443 项通过。
-- v0.53.0 已正式交付分组×验证×检索的组合验收。443 项回归、实际宿主与四组 CI 覆盖该组合；不改变审查行为或参数。
+- v0.54.0 已正式交付对齐结论与边界收尾。443 项回归、实际宿主与四组 CI 通过；npm、Release 与原包 104,761 字节一致，SHA-256、SHA-512、清单与发布说明核验通过；不改变审查行为或参数。
+- v0.53.0 已正式交付分组×验证×检索的组合验收。443 项回归、实际宿主、13 项独立安装专项与四组 CI 通过；npm、Release 与原包 104,757 字节一致，双哈希与清单核验通过；不改变审查行为或参数。
 - v0.52.1 已正式交付保守类实例方法导航。442 项回归、实际宿主、24 项独立安装专项和四组 CI 通过；npm、Release 与原包 104,817 字节一致，SHA-256、SHA-512 与清单核验通过。v0.52.0 复核发现接收者逃逸、静态修饰符与字段初始化器幻影方法误判且未参与预算省略，由 0.52.1 替代，未发布不计作交付。
 - v0.51.0 已正式交付多轮×窗口×检索×预算的组合验收。432 项回归、实际宿主、12 项独立安装专项与四组 CI 通过；npm、Release 与原包 102,433 字节一致，双哈希与清单核验通过；不改变审查行为或参数。
 - v0.50.0 已正式交付 ObjC/Swift/Kotlin/Java/C# 生命周期与并发细化提示。431 项回归、实际宿主、9 项独立安装专项和四组 CI 通过；npm、Release 与原包 102,412 字节一致，SHA-256、SHA-512 与清单核验通过。

package/CORE-SOURCE-INVENTORY.md

@@ -6,7 +6,7 @@
 
 ## 对照结论
 
-已阅读核心审查模块、54 篇语言规则，以及相关的 Git 命令、路径、模型和覆盖状态依赖。**阅读完成不等于实现完成。**
+已阅读核心审查模块、54 篇语言规则，以及相关的 Git 命令、路径、模型和覆盖状态依赖。**保守语法范围内的对应能力已实现并通过组合验收；剩余仅为超出保守边界的语义绑定（继承/动态分派）与后置的真实模型质量评测。**
 
 | 参考模块 | 当前对应能力 | 仍需补齐 |
 |---|---|---|
@@ -38,7 +38,7 @@
 - PO/POT、MyBatis 映射：文本身份、复数、占位符、绑定值与动态 SQL 提示。
 - JS/TS/React：hook、异步清理与渲染副作用提示。
 
-Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示、Objective-C/Swift/Kotlin/Java/C/C++ 的生命周期与并发细化提示也已交付。以下仍以通用指导为主：模板、依赖清单与基础设施的引擎版本和消费者约束，按“不按文件名推定行为”保留通用提示。全部提示不是语义解析、迁移执行结果或缺陷证据。
+Protobuf、Thrift、Cap’n Proto、GraphQL、Prisma 的专用指导已交付；Go/Python/Rust 的版本前提与调用契约提示、ArkTS 提示、Objective-C/Swift/Kotlin/Java/C/C++ 的生命周期与并发细化提示也已交付；模板引擎（Freemarker、Handlebars/Mustache、Jinja、Pug、Astro）与基础设施即代码（Terraform、Bicep）的转义边界、模板注入、硬编码凭据与生命周期保守提示也已交付。以下仍以通用指导为主：依赖清单与配置（Cargo.toml、composer.json、package.json、pom.xml、build.gradle、GitHub 工作流、yaml、properties、json）的引擎版本和消费者约束，按“不按文件名推定行为”保留通用提示。全部提示不是语义解析、迁移执行结果或缺陷证据。
 
 ## 固定参考文件索引
 

package/RELEASE-NOTES.md

@@ -1,12 +1,12 @@
-# v0.53.0 发布说明
+# v0.55.0 发布说明
 
-## 分组×验证×检索的组合验收
+## 模板引擎与基础设施即代码专用指导
 
-在同一审查生命周期内验证自动分组、候选反证验证与批准快照检索协同一致：覆盖统计总和等于审查文件数、每个入口输入不超过预算、产生候选后均完成验证、终态可判定。只读批准快照，不改变审查行为或参数，不新增读取也不放宽预算。
+本轮把此前对模板与基础设施文件的通用提示细化为按引擎的保守缺陷指导：Freemarker、Handlebars/Mustache、Jinja、Pug、Astro 关注转义边界、模板注入、缺失值与部分/继承；Terraform、Bicep 关注硬编码凭据、过度授权、状态/生命周期与版本可复现。全部提示只针对具体缺陷和反证，不照搬风格偏好或性能建议，也不新增读取或放宽预算。
 
-## 范围
+## 限制
 
-- 与多轮×窗口×检索×预算的组合验收共同覆盖主要组合；合成与分组的端到端仍由既有专项与两两组合测试覆盖。
-- 仍不是真实模型质量成绩；真实质量评测为后置项。
+- 只读批准快照，不新增读取、不放宽预算、不改变审查行为或参数。
+- 依赖清单与配置类文件（Cargo.toml、composer.json、package.json、pom.xml、build.gradle、GitHub 工作流、yaml、properties、json）仍保持通用提示，按“不按文件名推定行为”处理。
 
-使用方法见 [README](README.md)。
+使用方法见 [README](README.md)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feng0531/dsh-code-review",
-  "version": "0.53.0",
+  "version": "0.55.0",
   "private": false,
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },

package/src/defect-guidance.mjs

@@ -33,7 +33,14 @@ const checklists = {
  ocaml: ['Check option/result/exception paths, tail-recursion assumptions, physical versus structural equality and resource cleanup.', 'Check GADT/exhaustiveness and FFI lifetime; do not invent a module signature that is not captured.'],
  po: ['Check msgid/msgstr identity, plural-forms rules, format specifiers and their order, and encoding/NFC identity.', 'Check untranslated/fuzzy markers and placeholder mismatch against the actual extraction catalog.'],
  mybatis: ['Check parameter bound type, #{} versus ${}, collection iteration and NULL semantics in dynamic SQL against the mapper interface.', 'Check result map column/type, statement id uniqueness and cache invalidation; do not infer database behavior that is not captured.'],
- react: ['Check effect cleanup, stale closures over dependencies, and async setState after unmount or on cancelled requests.', 'Check list keys, event-handler reuse and render-phase side effects; do not classify a memo re-render as a defect without evidence.']
+ react: ['Check effect cleanup, stale closures over dependencies, and async setState after unmount or on cancelled requests.', 'Check list keys, event-handler reuse and render-phase side effects; do not classify a memo re-render as a defect without evidence.'],
+  freemarker: ['Check ${...} reaching HTML without auto-escaping or the matching ?html/?url/?js_string builtin, and flag ?no_esc/<#noautoesc> as an escape hatch on user-controlled values; do not report missing escaping when <#ftl output_format> or .ftlh/.ftlx auto-activates it.', 'Check template source, names or bodies derived from request input (<#include>, <#import>, get_optional_template) and ?new()/?api/?eval exposure on untrusted values; do not infer a restricted TemplateClassResolver without captured configuration.', 'Check absent values rendered without a ! default or ?? guard, a bare ! masking required data, and ! precedence guarding only the last segment; report concrete render failures, not optional display values.'],
+  handlebars: ['Check raw {{{value}}}/{{& value}} and double-braced values inside JS/CSS/URL/attribute/event contexts, requiring context-appropriate escaping or URL scheme validation; do not report ordinary {{value}} text the engine escapes by default.', 'Check dynamic partial names ({{> (lookup ...)}} or {{>*name}}) or helper/lambda reinterpretation of untrusted data without an allowlist, and recursive partial chains without data-dependent termination.', 'Check required values silently rendering empty, helper/context name collisions ({{name}} versus {{./name}}), and wrong section/context depth; report concrete output failures, not missing defaults for optional display values.'],
+  jinja: ['Check |safe, Markup or {% autoescape false %} on untrusted values, and HTML-escaped values inside JS/CSS/URL/attribute contexts against the configured autoescaping; do not report every {{ value }} as unescaped.', 'Check template source, expression fragments, filter or macro bodies, or dynamic include/import/extends targets derived from request data without an allowlist, and attr-filter traversal toward sensitive host objects.', 'Check required values silently rendering empty, |default(..., true) swallowing valid 0/False/empty, deep undefined chains, and block overrides dropping {{ super() }} or leaking caller context; report concrete failures only.'],
+  pug: ['Check !{value} / != value on untrusted HTML, escaped #{value} / = value in JS/CSS/JSON/URL/handler contexts, and &attributes(spread) or link/event attributes built from caller-controlled keys and values; do not report ordinary #{value} or = value HTML text.', 'Check script. blocks interpolating values without JS/JSON-safe serialization or without neutralizing </script>, and secrets or oversized objects serialized to client-visible markup.', 'Check attacker-authored template source (compile/render), request-controlled include/extends without an allowlist, and unbuffered code (-) performing filesystem/network/shared-state side effects; do not treat compile-time filters as runtime sanitizers of dynamic locals.'],
+  astro: ['Check set:html on untrusted content, and non-PUBLIC_ env, cookies, headers, sessions or secrets reaching client HTML, scripts or hydrated islands unless the boundary is intentional.', 'Check client:* directives on non-framework components, missing fallback for client:only or server:defer, and over-hydration from large or unnecessary islands.', 'Check props or data crossing server:defer or define:vars boundaries for functions, circular objects, secrets or oversized payloads; do not assume frontmatter values are reactive in the browser.'],
+  terraform: ['Check literal secrets (passwords, API keys, access keys, connection strings) assigned to arguments, variable/locals defaults or committed .tfvars, and credential-shaped variables missing sensitive = true.', 'Check 0.0.0.0/0, ::/0 or "*" sources on sensitive ports and wildcard IAM actions/resources or public ACLs without a public-content purpose stated in the diff.', 'Check committed .tfstate, removed prevent_destroy on stateful resources, stateful resources missing lifecycle where siblings have one, and unbounded provider/module versions where siblings pin; do not flag terraform fmt whitespace.'],
+  bicep: ['Check literal secrets (passwords, connection strings, API keys) on resource properties, parameter defaults or variables, and credential-shaped parameters missing @secure().', 'Check broad roleAssignments (Owner/Contributor), NSG rules with */Internet/0.0.0.0 on sensitive ports, and publicNetworkAccess enabled without compensating networkAcls or private endpoints.', 'Check storage without a pinned minimumTlsVersion or with supportsHttpsTrafficOnly = false only when the diff shows the insecure value, stale api-version relative to siblings, and unpinned module references where siblings pin; do not flag omitted optional hardening alone.']
 };
 export function defectGuidance(filePath, sourceText = '') {
  const lower = filePath.toLowerCase(), protocol = protocolGuidance(filePath);
@@ -44,8 +51,10 @@ export function defectGuidance(filePath, sourceText = '') {
  const language = protocol?.language ?? specialized ?? (/\.(c|cc|cpp|cxx|h|hh|hpp|hxx)$/.test(lower) ? 'cpp' : lower.endsWith('.cs') ? 'csharp' : /\.(js|jsx|mjs|cjs|ts|tsx)$/.test(lower) ? 'javascript' : /\.(json|yaml|yml|toml|ini|xml|properties)$/.test(lower) ? 'configuration' : 'generic');
  const fileType = /^\.github\/workflows\/.+\.(yaml|yml)$/.test(lower) ? 'github-workflow' : /(?:^|\/)(package\.json|cargo\.toml|pom\.xml|build\.gradle|composer\.json)$/.test(lower) ? 'dependency-manifest' : undefined;
  const purpose = fileType ?? (/\.(ftl|ftlh|ftlx|hbs|mustache|jinja2|j2|pug|astro)$/.test(lower) ? 'template' : /\.(tf|hcl|tfvars|bicep|nix)$/.test(lower) ? 'infrastructure' : /\.(proto|thrift|capnp|graphql|gql|prisma)$/.test(lower) ? 'protocol-schema' : undefined);
- const purposeChecks = purpose === 'template' ? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.'] : purpose === 'infrastructure' ? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.'] : purpose === 'protocol-schema' ? protocol.checks : [];
+ const templateFormat = /\.(ftl|ftlh|ftlx)$/.test(lower) ? 'freemarker' : /\.(hbs|mustache)$/.test(lower) ? 'handlebars' : /\.(jinja2|j2)$/.test(lower) ? 'jinja' : /\.pug$/.test(lower) ? 'pug' : /\.astro$/.test(lower) ? 'astro' : undefined;
+  const infraFormat = /\.(tf|hcl|tfvars)$/.test(lower) ? 'terraform' : /\.bicep$/.test(lower) ? 'bicep' : undefined;
+  const purposeChecks = purpose === 'protocol-schema' ? protocol.checks : purpose === 'template' ? (checklists[templateFormat] ?? ['Check escaping for the actual HTML/attribute/URL/script context, untrusted raw output and template execution boundaries.', 'Check missing/null variables and changed conditional branches against captured callers; do not invent engine defaults.']) : purpose === 'infrastructure' ? (checklists[infraFormat] ?? ['Check privilege/network exposure, secret/state handling and untrusted interpolation against actual provider semantics.', 'Check replacement/deletion, dependency order and changed defaults for concrete data loss or service disruption; configuration is not an applied plan.']) : [];
  const reactChecks = /\.(jsx|tsx)$/.test(lower) ? checklists.react : [];
  const typeChecks = fileType === 'github-workflow' ? ['Check event trust boundaries, token permissions and fork/PR-controlled inputs before privileged commands or secret exposure.', 'Check expression interpolation into shell commands, checkout/ref provenance, artifact/cache trust and required job dependency gates.'] : fileType === 'dependency-manifest' ? ['Check changed dependency versions/features against consumers, lock/resolution evidence and runtime compatibility; do not invent a vulnerability from a package name.', 'Check executable install/build hooks, publish/export entry points and platform constraints for concrete changed behavior.'] : [];
- return { version:5, language, ...(sniffed ? {selection:'bounded-first-nonblank-line-hint'} : {}), ...(purpose ? {fileType:purpose} : {}), checks:[...common,...(checklists[language] ?? []),...reactChecks,...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
+ return { version:5, language, ...(sniffed ? {selection:'bounded-first-nonblank-line-hint'} : {}), ...(purpose ? {fileType:purpose} : {}), ...(templateFormat || infraFormat ? {format: templateFormat ?? infraFormat} : {}), checks:[...common,...(checklists[language] ?? []),...reactChecks,...typeChecks,...purposeChecks], notice:'Guidance is not evidence, a semantic parser, a style rule or permission to read outside the snapshot.' };
 }